Slashdot Mirror
Intel SPI Flash Flaw Lets Attackers Alter or Delete BIOS/UEFI Firmware (bleepingcomputer.com)
Catalin Cimpanu, writing for BleepingComputer: Intel has addressed a vulnerability in the configuration of several CPU series that allow an attacker to alter the behavior of the chip's SPI Flash memory -- a mandatory component used during the boot-up process [1, 2, 3]. According to Lenovo, who recently deployed the Intel fixes, "the configuration of the system firmware device (SPI flash) could allow an attacker to block BIOS/UEFI updates, or to selectively erase or corrupt portions of the firmware." Lenovo engineers say "this would most likely result in a visible malfunction, but could in rare circumstances result in arbitrary code execution."
Not another industry-wide patching, I hope. I can't take another industry-wide patching.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
Yeah, me too.
Wait, where's the slick marketing name for the vulnerability? Where's the logo? The website?
You seem to be unaware that modern computers do not have a BIOS anymore and that it gets emulated by UEFI.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
It doesn't affect BIOS, just UEFI.
It affects the SPI flash which could be used against either BIOS or UEFI
It is always hairy when you apply a firmware fix but I am pleased to say that Lenovo's update for the ThinkCentre M70 works just fine. Although, it took a while to apply and power cycled 3 times. At one point I almost said, "Fuck! It bricked."
I am tired of having to rely on software security measures that will inevitably not work. Give me a fucking switch to turn off write access in hardware. The IT industry sucks.
at all. Firmware, especially, since otherwise this is supposed to not be possible, resulting in a brick. Know it. Live it. Intel can't do software! And barely hardware. And you know why this is TRUE.
Same reason why you'd be much better off with Real Servers That Are Headless: A serial console is much more flexible and safer than a built-in KVM/IMPI/LOM/whatever (with accompanying controller, firmware, network connection, and so on) or the same thing stuffed right into your south bridge with more functions besides, the iME/PSP. Oh, and open source firmware would be nice. That too.
foiled again.
-some agency
Lenovo doesn't release software updates. Ever. The comments attributed to Lenovo engineers in TFA are actually from the NVD vulnerability database which, themselves, are based on the MITRE vulnerability database entry.
They literally (intentionally?) broke the SPI write-lock switch back in the 8 MBit days and instead made it 'write-lock *ONLY IF* hardware sense pin+post-power on software enable are both set.' What does that mean in layman's terms? Glitching power can cause the SPI flash to believe it has been power cycled. Since the write protect requires software intervention to enable and since said write protect function is only normally run at boot time, said glitching can unlock the bios write protect post-boot, allowing arbitrary reflashing after boot. Intel's kludge to fix this was adding write protection into the southbridge/firmware controller hub that blocks read/write access to memory ranges after boot without a properly signed image, only not all their hardware does it properly and there are other ways to get around it (external reflashing on some boards before they started requiring all the signed blobs for everything.) Now, rather than a simple 1 pin to write disable the whole chip, you have 2-3 different possible ways your bios memory range is write protected, none of which may keep hackers or governments from injecting unwanted changes into your SPI flash/bios images for purposes most of us would rather not thing about.
The only solutions to this problem are new hardware or 'shim hardware' that sits between the spi flash chip and the motherboard and relays commands between them, filtering write and erase calls for the specific SPI chip in the system (since for some stupid reason this stuff isn't fully standardized and while most chips can be read with generic commands, write and erase is sometimes non-standard even among the same product designation, but different generations/iterations of part!) Truly a step back from the parallel/lpc flash days.
All these Intel security flaws are insane. If the next MacBook Air replacement runs on Apple's A12 or whatever, I'm switching.
#DeleteFacebook
We can now jailbreak the laptop, and install our own open-souce, secure boot rom!
Let's get busy!
Take the cheese to sickbay, the doctor should see it as soon as possible - B'Elanna Torres, "Learning Curve"
we can use this flaw to patch out Intel ME?
Switches are neat for microphones, speakers, and batteries too.
Fuck, even James 'Big Hands' Comey knows the value of taping over a laptop camera because the manufacturer couldn't trouble themselves with designing a slidable lens cap.
had this problem and worse...
The problem was uncovered by Ubuntu last year: https://linux.slashdot.org/sto...
It was so grave they had to pull down released version and patch the workaround.
:wq
Is that another flaw that's only patched through their windows updater ?
"this would most likely result in a visible malfunction
I bought a brand new cheap laptop, worked with it for around 4 months and after browsing the net my four arrow keys won't work. No amount of reboot nor amount of Linux re-installation can fix the 4 cursor kebyard keys. I knew something is wrong with my UEFI being tampered by malicious actors on the web or via the uncontrollable Intel IME hole, just so I buy a new one. The IME hole is the big culprit since my machine calls home as soon as my laptop is connected to the net, no way to disable nor monitor the activity on my machine, but I saw the communication via TCP in my router logs a day after.
Change log:
2018/01/01 - Added 14 Useful Links. Disable Intel ME 11 via undocumented NSA "High Assurance Platform" mode with me_cleaner, Blackhat Dec 2017 Intel ME presentation, Intel ME CVEs (CVSS Scored 7.2-10.0)
Intel CPU Backdoor Report
The goal of this report is to make the existence of Intel CPU backdoors a common knowledge and provide information on backdoor removal.
What we know about Intel CPU backdoors so far:
TL;DR version
Your Intel CPU and Chipset is running a backdoor as we speak.
The backdoor hardware is inside the CPU/Bridge and the backdoor firmware (Intel Management Engine) is in the chipset flash memory.
30C3 Intel ME live hack:
[Video] 30C3: Persistent, Stealthy, Remote-controlled Dedicated Hardware Malware
@21:43, keystrokes leaked from Intel ME above the OS, wireshark failed to detect packets.
[Quotes] Vortrag:
"the ME provides a perfect environment for undetectable sensitive data leakage on behalf of the attacker".
"We can permanently monitor the keyboard buffer on both operating system targets."
Decoding Intel backdoors:
The situation is out of control and the Libreboot/Coreboot community is looking for BIOS/Firmware experts to help with the Intel ME decoding effort.
If you are skilled in these areas, download Intel ME firmwares from this collection and have a go at them, beware Intel is using a lot of counter measures to prevent their backdoors from being decoded (explained below).
Backdoor removal:
The backdoor firmware can be removed by following this guide using the me_cleaner script.
Removal requires a Raspberry Pi (with GPIO pins) and a SOIC clip.
2017 Dec Update:
Intel ME on recent CPUs may be disabled by enabling the undocumented NSA HAP mode, use me_cleaner with -S option to set the HAP bit, see me_cleaner: HAP AltMeDisable bit.
Useful links (Added 2018 Jan 1):
Disabling Intel ME 11 via undocumented HAP mode (NSA High Assurance Platform mode)
me_cleaner: Set HAP AltMeDisable bit with -S option
Blackhat 2017: How To Hack A Turned Off Computer Or Running Unsigned Code In Intel Management Engine
EFF: Intel's Management Engine is a security hazard, and users need a way to disable it
Sakaki's EFI Install Guide/Disabling the Intel Management Engine
Intel ME bug storm: Hardware vendors race to identify and provide updates for dangerous Intel flaws.
CVE-2017-5689: An unprivileged network attacker could ga
Does this mean we will be able to install Coreboot on most laptops soon?